fix: WebSocket reconnect state refresh, listener leak fixes, pin container images

- F4: Fetch fresh server state after WebSocket reconnect
- F5: Guard message polling timer with auth check, stop on logout
- F6: Remove NIP-07 listener in appLauncher close()
- F7: Initialize audio player once to prevent listener stacking
- S3: Pin all container images to specific versions, create image-versions.sh

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

scripts/fix-indeedhub-containers.sh

@@ -1,6 +1,10 @@
 #!/bin/bash
 set -e
 
+# Source pinned image versions (single source of truth)
+SCRIPT_DIR="$(cd "$(dirname "$0")" && pwd)"
+[ -f "$SCRIPT_DIR/image-versions.sh" ] && . "$SCRIPT_DIR/image-versions.sh"
+
 # Fix corrupted IndeedHub containers + SearXNG
 # All images were exported as the same (wrong) image during multi-node deploy.
 # This script: stops broken containers, removes them, recreates with correct images.
@@ -24,7 +28,7 @@ fi
 
 # Verify correct images are available
 echo "Verifying images..."
-for img in "docker.io/library/redis:7-alpine" "docker.io/minio/minio:latest" "docker.io/library/postgres:16-alpine" "docker.io/scsibug/nostr-rs-relay:latest" "docker.io/searxng/searxng:latest" "localhost/indeedhub:latest" "localhost/indeedhub-build_api:latest" "localhost/indeedhub-build_ffmpeg-worker:latest"; do
+for img in "${INDEEDHUB_REDIS_IMAGE:-docker.io/library/redis:7-alpine}" "${MINIO_IMAGE:-docker.io/minio/minio:RELEASE.2024-11-07T00-52-20Z}" "${INDEEDHUB_POSTGRES_IMAGE:-docker.io/library/postgres:16-alpine}" "${NOSTR_RS_RELAY_IMAGE:-docker.io/scsibug/nostr-rs-relay:0.9.0}" "${SEARXNG_IMAGE:-docker.io/searxng/searxng:2024.11.17}" "localhost/indeedhub:local" "localhost/indeedhub-build_api:local" "localhost/indeedhub-build_ffmpeg-worker:local"; do
   if ! podman image exists "$img" 2>/dev/null; then
     echo "ERROR: Missing image $img"
     exit 1
@@ -88,7 +92,7 @@ podman run -d --name indeedhub-minio \
   -v indeedhub-minio-data:/data \
   -e MINIO_ROOT_USER=indeeadmin \
   -e MINIO_ROOT_PASSWORD=indeeadmin2026 \
-  docker.io/minio/minio:latest \
+  "${MINIO_IMAGE:-docker.io/minio/minio:RELEASE.2024-11-07T00-52-20Z}" \
   server /data --console-address ":9001"
 
 # 4. Nostr Relay
@@ -97,7 +101,7 @@ podman run -d --name indeedhub-relay \
   --restart unless-stopped \
   --network "$NETWORK" --network-alias relay \
   -v indeedhub-relay-data:/usr/src/app/db \
-  docker.io/scsibug/nostr-rs-relay:latest
+  "${NOSTR_RS_RELAY_IMAGE:-docker.io/scsibug/nostr-rs-relay:0.9.0}"
 
 # 5. API
 echo "Creating api..."
@@ -137,7 +141,7 @@ podman run -d --name indeedhub-build_api_1 \
   --health-timeout 30s \
   --health-retries 5 \
   --health-start-period 60s \
-  localhost/indeedhub-build_api:latest \
+  localhost/indeedhub-build_api:local \
   sh -c "echo 'Running database migrations...' && npx typeorm migration:run -d dist/database/ormconfig.js && echo 'Migrations complete.' && npm run start:prod"
 
 # 6. FFmpeg Worker
@@ -162,7 +166,7 @@ podman run -d --name indeedhub-build_ffmpeg-worker_1 \
   -e S3_PUBLIC_BUCKET_NAME=indeedhub-public \
   -e S3_PUBLIC_BUCKET_URL=/storage \
   -e AES_MASTER_SECRET=0123456789abcdef0123456789abcdef \
-  localhost/indeedhub-build_ffmpeg-worker:latest
+  localhost/indeedhub-build_ffmpeg-worker:local
 
 # 7. IndeedHub Frontend
 echo "Creating indeedhub frontend..."
@@ -175,7 +179,7 @@ podman run -d --name indeedhub \
   --label "com.archipelago.version=0.1.0" \
   --label "com.archipelago.category=media" \
   --label "com.archipelago.port=7777" \
-  localhost/indeedhub:latest
+  localhost/indeedhub:local
 
 # Fix IndeedHub for iframe: remove X-Frame-Options, inject nostr-provider, hardcode container IPs
 sleep 3
@@ -223,7 +227,7 @@ echo "Creating searxng..."
 podman run -d --name searxng \
   --restart unless-stopped \
   -p 8888:8080 \
-  docker.io/searxng/searxng:latest
+  "${SEARXNG_IMAGE:-docker.io/searxng/searxng:2024.11.17}"
 
 echo ""
 echo "=== Verifying container status ==="